CCAC Theses and Dissertations

Campus Access Only

All rights reserved. This publication is intended for use solely by faculty, students, and staff of Nova Southeastern University. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, now known or later developed, including but not limited to photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the author or the publisher.

Date of Award

2026

Document Type

Dissertation - NSU Access Only

Degree Name

Doctor of Philosophy in Information Systems (DISS)

Advisor

Ling Wang

Keywords

Cyber Awareness; Cyber Resilience; Cybersecurity; Sallieu Kanu; Small Business; Social Engineering

Abstract

Cyber-attacks continue to impose substantial financial, operational, and reputational costs on organizations, with small and medium-sized businesses (SMBs) remaining especially vulnerable because of limited cybersecurity resources, personnel, training, and awareness. Although large organizations are frequent targets of cybercrime, SMBs are increasingly exposed to both technical and human-centered threats. Among these threats, social engineering remains particularly challenging because it exploits human behavior, trust, urgency, authority, and lack of cybersecurity knowledge to gain unauthorized access to sensitive information. As a result, improving cybersecurity and privacy awareness and strengthening cyber resilience are essential for helping SMB users recognize, respond to, and recover from cyber threats. The purpose of this quantitative study was to empirically examine cybersecurity and privacy awareness (CPA) within the context of cyber resilience and social engineering risk among SMB users in the United States. The study evaluated a theoretical model informed by literature on cybersecurity awareness, privacy awareness, social engineering, organizational support, observational learning, and cyber resilience. Specifically, the study investigated the extent to which cybersecurity-related factors predicted cybersecurity privacy awareness and cyber resilience, as well as whether awareness and resilience were associated with reduced susceptibility to social engineering attacks. A web-based, scenario-based survey design was used to collect data using a 5-Point Likert Scale from 115 individuals employed by small businesses in the United States with fewer than 500 employees. The study included a structured CPA training intervention, with assessments administered before and after the training. The research instrument and study design were reviewed and validated by cybersecurity subject-matter experts (SMEs) through the Delphi process. Data was analyzed using Partial Least Squares Structural Equation Modeling (PLS-SEM), repeated-measures Analysis of Variance (ANOVA), and bivariate regression analysis. The findings indicated that organizational support and observational learning were important contributors to cybersecurity privacy awareness among SMB users. Organizational support emerged as the strongest predictor, suggesting that employees are more likely to develop cybersecurity and privacy awareness when their organizations provide guidance, resources, leadership reinforcement, and a culture that supports secure behavior. Observational learning also contributed to cybersecurity privacy awareness, indicating that employees’ cybersecurity attitudes and practices may be shaped by the behaviors they observe among coworkers, supervisors, and the broader workplace environment. The findings further indicated a positive relationship between cybersecurity privacy awareness and cyber resilience, suggesting that awareness may help employees recognize cyber threats, respond appropriately to incidents, and support organizational continuity and recovery. However, the results also showed that cybersecurity privacy awareness did not meaningfully improve following the training intervention. This finding suggests that a single awareness training session may be insufficient to produce measurable changes in employee awareness and that cybersecurity education may require continuous reinforcement, practical engagement, and integration into daily workplace practices. In addition, cybersecurity privacy awareness did not reduce susceptibility to social engineering attacks, and cyber resilience was not directly associated with reduced social engineering risk. These findings suggest that awareness and resilience, although important, may not be sufficient on their own to prevent socially engineered attacks. Instead, reducing susceptibility to these attacks may require behavior-focused strategies, including repeated training, realistic simulations, scenario-based exercises, leadership reinforcement, and clear procedures for identifying and reporting suspicious activity. Although several meaningful relationships were identified among the tested variables, the overall structural model did not fully meet accepted standards for model fit. Therefore, the findings should be interpreted with caution. The results suggest that additional factors, such as prior cybersecurity experience, organizational culture, perceived threat severity, employee confidence, training frequency, leadership involvement, and reporting mechanisms, may influence cybersecurity and privacy awareness, cyber resilience, and susceptibility to social engineering among SMB users. This study contributes to the cybersecurity literature by providing empirical evidence on the relationships among cybersecurity privacy awareness, cyber resilience, organizational support, observational learning, and social engineering risk in SMB environments. The findings indicate that improving cybersecurity outcomes in SMBs requires more than awareness-based instruction alone. A comprehensive approach that combines organizational support, workplace modeling, continuous education, practical exercises, and resilience planning may better equip SMB users to recognize, respond to, and mitigate the effects of cyber threats. Ultimately, the study provides actionable insights for SMB leaders, cybersecurity practitioners, and researchers seeking to strengthen cyber resilience and reduce human vulnerabilities that enable successful social engineering attacks.

Download
To access this thesis/dissertation you must have a valid nova.edu OR mynsu.nova.edu email address and create an account for NSUWorks.

Free My Thesis

If you are the author of this work and would like to grant permission to make it openly accessible to all, please click the Free My Thesis button.

  Contact Author

Share

COinS